VillaTheme DEPART EUVD-2026-109675

Exploitation requires an authenticated low-privilege account on the target site (CVSS PR:L), so it is not anonymous/unauthenticated; the plugin DEPART (depart-deposit-and-part-payment-for-woo) must be installed and active at version 1.0.10 or earlier, which in practice means a WooCommerce store using this deposit/part-payment extension. No user interaction is required (UI:N) and the attack is network-reachable with low complexity (AV:N/AC:L). The specific feature, endpoint, or configuration that lacks the authorization check is not described in the available sources, so the exact prerequisite action cannot be named; the primary limiting factors are the need for a valid (even if low-tier) account and the plugin's presence, while impact is bounded to limited integrity changes (C:N/I:L/A:N).

This is a medium-severity (CVSS 4.3) missing authorization flaw (CWE-862) in the VillaTheme DEPART WordPress/WooCommerce plugin, and the available signals converge on a moderate, non-urgent priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates a network-reachable, low-complexity flaw that requires an authenticated low-privilege account (PR:L) and yields only limited integrity impact with no confidentiality or availability loss - consistent with a logged-in user performing an action they should not be authorized to perform. The vuln.today decision label is 'this_month,' which matches a patch-in-normal-cycle posture, not act_now/emergency. No KEV listing is present (not confirmed actively exploited) and no EPSS score was provided, so exploitation probability cannot be quantified from the input. The only reference is the Patchstack advisory database entry, which is a vendor/coordinator advisory rather than verified working exploit code. In short, this is a real but bounded broken-access-control issue, not a high-CVSS-but-illusory finding nor a widespread-exploitation crisis; the main limiting factor is the requirement for an existing authenticated account. EPSS and KEV data are both absent/negative, so prioritization rests on the moderate CVSS and the 'this_month' decision label.

An attacker who holds any low-privilege authenticated account (for example a WooCommerce customer/subscriber) on a site running DEPART ≤ 1.0.10 sends a crafted request to a plugin endpoint that fails to verify authorization, performing an action reserved for higher-privileged users and tampering with deposit/part-payment data (limited integrity impact, no data disclosure). No user interaction is needed and attack complexity is low (AC:L). No verified working exploit code is identified in the input; only a Patchstack advisory reference exists.